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DESIGN OF AUTOMATIC STARTUP AND SHUTDOWN LOGIC FOR A 
BRAYTON-CYCLE 2- TO 15-KILOWATT ENGINE 
by James E. Vrancik and Richard C. Bainbridge 
Lewis Research Center 

SUMMARY 

The NASA Lewis Research Center is conducting a closed-Brayton-cycle power con- 
version system technology program in which a complete power system (engine) has been 
designed and demonstrated. This report discusses the design of automatic startup and 
shutdown logic circuits as a modification to the control system presently used in this 
demonstration engine. This modification was primarily intended to make starting the 
engine as simple and safe as possible and to allow the engine to be run unattended. In 
the modified configuration the engine is started by turning the control console power on 
and pushing the start button after preheating the gas loop. No other operator action is 
required to effect a complete startup. Shutdown, if one is required, is also effected by 
a simple stop button. The automatic startup and shutdown of the engine have been suc- 
cessfully and purposefully demonstrated more than 50 times at the Lewis Research Cen- 
ter during over 10 000 hours of unattended operation. The net effect of this modification 
is an engine that can be safely started and stopped by relatively untrained personnel. 

The approach lends itself directly to remote unattended operation. 


INTRODUCTION 

A closed-Brayton-cycle engine was tested at the Lewis Research Center. The 
Brayton engine was comprised of first -gene ration components for which there were very 
little component experimental data. In addition, no system experimental data were 
available, particularly with respect to startup, shutdown, and control. As a result an 
effort was made to incorporate redundant and alternate subsystems where a failure could 
interfere with the overall testing schedule. At the end of about 3800 hours of perfor- 
mance and endurance testing, it was determined that the engine could be improved and 
simplified on the basis of the data and experience gained. Reference 1 provides a 



complete description of the engine and components and of the initial experimental results 
from the testing program. 

As part of the ongoing component technology improvement program the startup and 
shutdown of the Brayton engine were completely automated by modification of the orig- 
inal control system described in references 2 and 3. The control system was reduced in 
size by removing controls and instrumentation which proved unnecessary. Also, the 
redundant oil coolant loop was removed, hardware required for gas injection startup was 
removed and replaced by motor startup hardware (ref. 4), and four jacking gas valves 
were combined and replaced by two. The net effect is an operational power conversion 
system that is smaller, lighter, more reliable, and much easier to operate. 

This report deals with logic and electronic circuit design for the automation of the 
startup and shutdown of the Brayton engine. The primary objectives were to make start- 
ing the engine as simple as possible and to allow unattended operation. Originally, with 
a manual start, extensive operator training requiring detailed knowledge of operating 
procedures and engine operating conditions was necessary to operate the system. In 
practice, several people usually assisted in startup. This approach was justified when 
the engine was first being tested and a large number of uncertainties existed in its re- 
sponse. However, through experience, the Brayton engine was found to be predictable 
to the point where very rigid startup and operating procedures could be imposed with no 
ambiguity in performance. Thus, a completely automatic startup and shutdown system 
was developed and implemented to simplify further testing of the Brayton engine. 


STARTUP AND SHUTDOWN SEQUENCE 

Brayton engine startup, modified by the automatic startup and shutdown logic, con- 
sists of turning the control system on, waiting a few minutes for thermocouple ovens to 
warm up, and pushing the start button. This assumes that, as part of facility control, 
the test support heat source has been brought up to operating temperature and there is 
sufficient thermal energy to allow an engine startup (ref. 1). Once the engine startup is 
initiated, jacking gas is used to float the Brayton rotating unit (BRU) turboalternator - 
compressor shaft, and the engine is motored to a speed of approximately 12 000 rpm. 

The engine continues to motor at this speed until the turbine inlet temperature reaches 
728 K, the temperature at which turbine work exceeds compressor work and rotational 
losses by a safe margin. At this time the motor start inverter is turned off. The engine 
then bootstraps to the 36 000 -rpm design speed and begins producing electrical output 
power. The complete startup can be performed by a single person having no knowledge 
of the Brayton engine. 

Automatic shutdown circuits are activated during both startup and steady- state 
operation to monitor engine operation. If out -of -tolerance conditions are detected by the 
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redundant monitoring circuits, a shutdown is initiated. Shutdown is accomplished by 
automatically applying 1. 5 times rated load to the alternator and discharging the work- 
ing gas in the loop. Jacking gas is also applied to protect the bearings. The BRU 
quickly decelerates to 5 rpm, at which time the jacking gas and parasitic load are re- 
moved and the BRU rests on the bearing. The console power is manually turned off if 
the engine is not to be restarted. 


Design Requirements 

The logic circuits needed to achieve automatic startup and shutdown were incorpo- 
rated into the existing Brayton control system printed- circuit card file. The existing 
power supplies were sufficient to power the additional circuits. All logic elements were 
SN7400 series transistor-transistor logic (TTL) with a few discrete transistors to inter- 
face to higher voltage circuits. 

All circuits were designed such that a single failure at any time would, at most, 
cause a safe orderly shutdown. No single failure would inhibit a safe shutdown. No 
single failure that could combine with another random single failure to cause a problem 
would go undetected. (A problem in this case is defined as an event that could induce the 
failure of a major power system component, e.g. , by allowing overheating or over- 
speeding. ) Any one printed- circuit card could be removed from the rack at any time 
with the only effect being a safe orderly shutdown. No attempt was made to account for 
the possibility of several failures at once. These are essentially the same design re- 
quirements that .were followed in designing the original card file. 


Startup Sequence 

A normal automatic Brayton engine startup sequence is as follows: When the start 
button is pushed, the jacking gas valve (JGV) opens. Jacking gas pressure floats the 
BRU shaft and causes a slow reverse rotation. At 40 rpm, the motor start inverter 
contactors (K506 and K507) close. Two seconds later the inverter starts, and the engine 
accelerates to approximately 12 000 rpm (synchronous speed at the inverter frequency) 
in about 10 seconds. When the turbine inlet temperature reaches 728 K, and the speed 
is over 10 000 rpm, the inverter is turned off after a 2-second delay. The engine then 
continues to accelerate. At 26 000 rpm the alternator field power is applied. At 
30 000 rpm the batteries are removed from the dc bus, after a 4 -second delay, if the 
dc supply is producing power. At 35 000 rpm the jacking gas is turned off. At 
36 000 rpm the speed control becomes active and electrical power output is available. 


3 


The startup sequence actually begins when the dc control power is turned on. The 
control panel is presented in figure 1. After the ±28 -volt power is turned on and con- 
trol panel power supplies begin operating, a mono stable with a 50 -millisecond delay 
issues a 2 -second initialize pulse (I -pulse) to initialize all flip-flops and to acknowledge 
all panel alarms. The responses to the I -pulse are as follows: 

(1) All startup sequence lights are turned off. 

(2) The main jacking gas valve is closed. 

(3) The backup jacking gas valve is closed. 

(4) The jacking gas valves are closed. 

(5) The start permissive flip-flop is set. 

(6) The start flip-flop is reset. 

(7) Shutdown circuits are disabled. 

(8) Startup is inhibited until I -pulse is complete (2 sec). 

(9) All alarms are acknowledged. 

(10) Motor start inverter control power is turned off. 

(11) The motor start inverter input (K507) and output (K506) breakers are opened. 

(12) Cavity pressure is set to low value. 

If and when the system is ready to be started, the start light will begin flashing. 

The following conditions are necessary before a startup: 

(1) The initialize pulse is finished. 

(2) All override switches are in proper position. 

(3) The start permissive flip-flop is set. 

(4) The coolant loop oil flow is above the minimum limit setpoint. 

(5) The heat source temperature is above the minimum limit setpoint. 

The override switches that are used as a start permissive condition and their proper 
positions are given in table I. The start permissive flip-flop is set by the I-pulse and 
is cleared by a completed startup. In the event of a shutdown prior to completion of the 
startup sequence, this flip-flop will inhibit any further action by the startup logic even 
though all other start permissive conditions are met. The dc power must be turned off 
and then back on again to generate another I-pulse. A flow chart of this turnon sequence 
is shown in figure 2. 

The startup sequence will be initiated if the start button is pushed when it is flash- 
ing and all start permissive conditions are met. If prior to pushing the button the con- 
ditions are no longer satisfied (i. e. , an override switch is placed in an improper con- 
dition), the start light will continue flashing but will go out if it is pushed. No startup 
will occur. If later the conditions are satisfied again, the light will flash and a startup 
is possible. 

The startup sequence flow chart is shown in figure 3. Such logic decisions as 
whether the jacking gas valves are open or closed and whether K506 and K507 are open 
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or closed are decided by monitoring auxiliary contacts on the valves and relays rather 
than by monitoring open or close commands. 

The decision to start the motor is made only if (1) the start flip-flop is set; (2) the 
jacking gas valves are confirmed open; (3) the pressure switch is closed, indicating 
proper jacking gas pressure; and (4) the digital speed indication is greater than 
±40 rpm. (Application of jacking gas applies a small torque on the shaft causing slow 
reverse rotation of the engine. ) 

After K506 and K507 are confirmed closed, the startup sequence branches. The 
normal sequence is to start the inverter, wait for synchronous speed and turbine inlet 
temperature to rise high enough, and stop the inverter. This would cause K506 and 
K507 to open, and the sequence would continue. However, if at any time during the 
normal sequence either the input (K507) or the output (K506) breaker were to open, the 
inverter would be safely shut down. If the conditions were such that the engine would 
not bootstrap, it would decelerate to zero speed, the control system would reset, and 
the startup would be safely aborted. The decision to stop the motor start inverter is 
-made only if the turbine inlet temperature is higher than the setpoint (728 K) and the 
digital speed is greater than 10 000 rpm. A startup will be safely aborted anytime a 
shutdown is requested, either manually or automatically. If the motor start inverter is 
running at the time, it is commanded off, K506 and K507 are commanded open, and con- 
trol power is removed. This procedure will isolate the inverter from the engine, pro- 
tect the inverter, and allow the engine to decelerate. The start light will remain on 
(but will be inactive), and the startup sequence lights that have not been turned off will 
remain lit. 

The actual circuitry for the automatic startup is shown in figures 4 to 6 (cards E18, 
E19, E20, E21) and figure 7 (the start button). Figure 4 shows the main part of the 
startup sequence logic. All inputs come from TTL (or TTL compatible) logic. All out- 
puts except the inverter controls go to TTL logic. 

Figure 5, called the rotation detector card, shows the circuitry used to decode the 
digital readout of speed in the control system. Only speeds greater than 40, 10 000, 
and 35 000 rpm are output. These are used on cards E18 and E19 (figs. 4(a) and (b)) of 
the startup sequence and also in the shutdown sequence. 

Figure 6 (card E21) contains the light drivers for the first five lights for the startup 
sequence (the sixth light being driven directly from the JGV auxiliary contacts) and the 
primary JGV -enable flip-flop. Also, the start permissive logic and the I -pulse gener- 
ator are contained on card E21. The inverter -inhibit -off I Q signal is developed on 
card E21 and is logically 1 when I-pulse = "1, ,T when a shutdown is occurring, or when- 
ever the motor start inverter startup sequence light is off. Normally, I Q is zero only 
between the time the start button is pushed and the motor start inverter is turned off. 
The I Q pulse is used to lock open K506, K507, and the motor start inverter control 
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power in order to prevent applying the inverter to the alternator bus during normal 
operation. 

Figure 7, the start button circuit, shows the interface between the start permissive 
output (low active) of card E21 (fig. 6), the start button flasher and alarm, and the start 
sequence on card E19 (fig. 4(b)). 

A simplified drawing of the inverter inputs is shown in figure 8. The control power 
required is 1. 3 amperes. The output of the circuit in figure 4(b) was tested at 5 am- 
peres without the transistors coming out of saturation and overheating. 


Shutdown Sequence 

Shutdown of the engine can be caused by the shutdown pushbutton (fig. 1), by over- 
speed, or by three groups of shutdown parameters. The over speed sensing and shutdown 
sequence triple -redundant logic contained in the signal conditioner unit is not modified. 
The shutdown pushbutton is also unmodified, except that the shutdown parameters have 
been added in parallel to the pushbutton and cause exactly the same response as the 
pushbutton. The shutdown parameters in the three groups are listed in table II. 

Group 1 parameters are enabled (allowed to activate a shutdown) at 35 000 rpm and 
are singly monitored and signal conditioned. Any one parameter going out of limits (or 
any single failure of a monitoring circuit) will cause a shutdown. Group 2 parameters 
are enabled at 35 000 rpm and are triply monitored and signal conditioned such that at 
least two channels out of three must be out of limits to cause a shutdown. Group 3 pa- 
rameters are enabled at the same time that the motor start inverter is turned on and 
are all triply monitored as in group 2. 

All shutdown initiation signals are disabled when the speed drops below 40 rpm, and 
an automatic shutdown reset occurs at 5 rpm. A shutdown request from group 1, 2, 
or 3 must last for at least 0. 7 second to actively cause a shutdown request in the signal 
conditioner shutdown circuits. Any request that lasts less than 0. 7 second is ignored. 

If a shutdown request gets to the signal conditioner circuits, that channel is latched into 
the shutdown mode until manually reset. When two channels in the signal conditioner 
unit are latched into a shutdown mode, a shutdown occurs. A flow chart of the shutdown 
logic is shown in figure 9, and the circuitry for one channel of the shutdown logic is 
shown in figure 10. When a shutdown occurs, the shutdown request logic is latched. 

This protects the system against an accidental or premature reset signal, which would 
close the jacking gas valves and turn off field power during a shutdown. A shutdown 
signal overrides a reset signal if both are present at the same time. When the speed 
goes below 40 rpm, the shutdown signal is removed; and as the speed goes below 5 rpm, 
a reset pulse is generated and the engine stops. 
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CONCLUDING REMARKS 


The modification to the Brayton automatic startup and shutdown logic proposed 
herein was intended to make starting the Brayton cycle power conversion system as 
simple and reliable as possible. This objective has been met. In the present modified 
configuration the system is started (after sufficiently preheating the gas loop) by turning 
the control power on and pushing the start button. No other operator action is required 
to effect a complete startup. The automatic startup and shutdown have been success- 
fully demonstrated over 50 times at the Lewis Research Center during over 10 000 hours 
of unattended operation. 

The net effect of this system modification is an operational power conversion sys- 
tem that is more reliable and can be started and stopped by personnel with no special 
training. 

Lewis Research Center, 

National Aeronautics and Space Administration, 

Cleveland, Ohio, October 21, 1974, 

506-23. 
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TABLE I. - OVERRIDE SWITCHES USED AS 


START PERMISSIVE CONDITIONS 


Switch 

Proper position 

Main jacking gas valve 

Automatic 

Backup jacking gas valve 

Automatic 

Vehicle load breaker 

Off 

Gas inventory makeup valve 

Automatic or off 

Gas inventory bleed valve 

Automatic or off 

Gas inventory dump pilot valve 

Automatic 

Speed control override 



Voltage regulation inhibit 



Field control 




TABLE n. - SHUTDOWN PARAMETERS 


Group 

Parameter 

1 

Alternator voltage high 
Alternator voltage low 
Alternator current high 
Primary jacking gas valve open 
Backup jacking gas valve open 

2 

Cavity pressure low 
Speed low 

3 

Compressor inlet temperature high 
Turbine inlet temperature high 
Alternator output temperature high 
Compressor discharge pressure high 
Gas bottle pressure low 
External (facility support equipment 
malfunction) 








[START SEQUENCE ' 



GAS ON 

K506 AND-K507 CLOSED 
ON 

SPEED AND T6 TO TEMP 
'INVERTER OFF 

BACKING GAS VALVES CLOSED 




fSHljT DOWN | 


CD 


Figure 1. - Control panel. 




( Power orT) 


Pause 50 msec; 
I-pulse 2 sec 


No s 

Qvaif) 


Start tight 
flashing 




Figure 2. - Turnon sequence logic. 









Figure 3. - Startup sequence logic. 
























Start FF- "1" 
E19-44 

JGV open ■ "0" 
08-11 

Pressure switch closes ■ 'T 1 
D8-21 

Speed > 40 rpm - "0" 
£20-39 

Stop inverter pulse - "l" 
E19-39 


Speed >10 000 rpm = "O’* 
E20-43 

Furbine inlet T6 > 850K * "0" 
C18-36 

Start 0 -"l" 
E19-32 

JGV open ■ 11 1“ 
C2-37 


Shutdown reset < 5 rpm - "1" 
C9-42 



El 8-44 


E 18-37 
E 18-42 


E 18-40 
£18-36 


E 18-38 


Close K507, 2FPJ706 E 


Enable group 3 shutdowns, 
A 18, A 19, A20-12 
Close K506, 1FPJ706 H 


Synchronous speed and 
T6 ready, E21-38 

JGV closed. E21-43 


Enable backup JGV, C10-9 


0 

£21-14 
I-pulse * "1" 
E21-13 


£18-14 O I 0 

E 18-130 1 

£18-3 O 1 



(a! Card E18, 

Figure 4. - Startup sequence logic circuit. 


Components 

Inverters, SN7404 
Two input NOR'S, SN74D2 
(two packages! 

Three input NOR's, SN7427 
Two input NANO's, SN7403 
Three input NANO's, 5N7410 
Monostable OS’s, 5N74121 
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Jacking gas on, 
IFPJ706-S 


K506 and K507 closed, 
IF PJ706-r 


Inverter on. 
IFPJ706-Q 


Synchronize speed 
'and T6 ready, 
IFPJ706-P 


Inverter otf, 
|FPJ706-n 


Enable JGV, 
CIO-42 


Jacking gas off, IFPJ706- 


I-pulse to E18-13 
and £18-19, 
1FPJ706-M 


and initialize pulse circuit (card E21). 




















Figure 9. - Shutdown logic. 
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